Extracted

• • Target
    Order Details_pdf.exe
  • Size 663KB
  • SHA256 de006c9526937934142c1f991be7b89fe9d9fd6c080bc340e8fc542e850fd4f4
  • MD5 951a0a855a8bdec4bd6bfba0b116f4fb
  • SHA1 5ca5b8fa973d1fdd1b5c669251123f6023cd2178
  • SHA512 bd5cf4253fc12b76d6cfae7d920b84cf4cfa0078c7bdbeb41d9813cc8789b04c959788319f7bcae0f4ecc7ef2567cf360e7e46905afffb8c8f1f53e89ce609fe
  • MD5 SHA1 SHA512

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • AgentTesla Payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spyware

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spyware

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2